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We propose easy implementable protocols for robust quan- 
tum key distribution with the collective dephasing channel or 
collective rotating channel. In these protocols, Bob only takes 
passive photon detection to measure the polarization qubits 
in the random bases. The source for the protocol with collec- 
tive rotating channel is made by type 2 spontaneous paramet- 
ric down conversion with random unitary rotation and phase 
shifter, no quantum disentangler is required. A simple proof 
for unconditionally security is shown. 

Consider the following collective dephasing channel to 
polarization qubits [1]: 
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and A = <f>$ + <f>i. Here |0),|1) represent for horizon- 
tal and vertical polarization states respectively. Ob- 
viously, 2-qubit state |01), 1 10) and their arbitrary lin- 
ear superposition will be robust via the above defined 
noise, since they will only obtain an unimportant over- 
all phase shift which is not detectable. Naturally, one 
may consider to replace the original single qubit BB84 
states [2] by the 2-qubit states randomly chosen from 
the set {|01>, 1 10), ^(|01) + |10», ^(|01) - |10»} to do 
the quantum key distribution (QKD) [2,3] if the dom- 
inant channel noise is the above defined collective de- 
phasing noise. There has been a proposal on how to ex- 
perimentally realize the decoherence-free subspace QKD 
very recently [4,5]. However, no security proof for any of 
such type of protocols is given so far. Also, the existing 
protocol [5] with collective rotating error uses 4-photon 
state which is technically very difficult in practice. In 
this paper, we propose easy implementable robust QKD 
protocols with both collective dephasing channel [4] and 
collective rotating channel [5] and we also give a simple 
proof for the unconditional security in both cases. We 
first give a QKD protocol that tolerates the collective 
phase error as the following: 

protocol 1 1: Alice creates (4 + 6)n single qubit state 
randomly chosen from {|0),|1),|+), |-)} (|±) = ^(|0)± 

|1))) and (4 + S)n ancilla which are all in state |0). She 
then encodes each individual qubit with an ancilla into 
a 2-qubit code through |00) — ► |01); 1 10) — ► |10) where 
the second qubit states in the left hand-side of the ar- 
rows are for the ancilla. After this operation, she now 
has made (4 + S)n 2-qubit quantum codes with each of 
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them randomly chosen from the set {|01), |10), "^7|(|01) + 
|10)), 4§(|01) - |10»}. 2: For each 2-bit code, she puts 
down the "preparation basis" as "Z basis" ({|0), |1)} ba- 
sis) if it is in state 1 01) or 1 10) and the preparation 
basis as "X basis" ({|±)}) if it is in one of the states 
{-L(|01) + |10>), -^(|01) - |10))}. For those code states 

of |01) or {:4(|01) + 1 10>), she denotes a bit value ; for 
those code states of 1 10) or {-d=(|01) — 1 10)), she denotes 
a bit value 1. 3: Alice sends the 2-qubit codes to Bob. 4: 
Bob receives the (4+<5)n 2-qubit codes. To each code, He 
measures the first qubit (the one in the right position of 
the state) in X basis and then measures the other qubit 
(say, qubit 2) in either X basis or Z basis after taking 
a unitary transformation U to it. Unitary U to qubit 2 
is dependent on the measurement outcome of qubit 1: If 
the outcome is |+), U is unity, /; if it is |— ), U is a z which 
is defined by a z \Q) = |0);er z |l) = — 11). Bob denotes his 
"measurement basis" just the same as his measurement 
basis to qubit 2. And, if the outcome to qubit 2 is |0) or 
|+), he puts down a bit value 0; if the outcome to qubit 
2 is |1) or |— ), he puts down a bit value 1. 5: Alice an- 
nounces her "preparation basis" for each codes. 6: Alice 
and Bob discards those bits on which Bob has measured 
in a basis diffrcnt from Alice's preparation basis. With 
high probability, there are at least 2n bits left (if not, 
abort the protocol). Alice decides randomly on a set of n 
bits to use for the protocol, and the rest to be check bits. 
7 : Alice and Bob announce the values of their check bits. 
If too few of these values agree, they abort the protocol. 
8: Alice and Bob distill the final key by using the classi- 
cal CSS code [6]. 

Before we make the security proof, we first take a look 
at its fault tolerance property. Since we have already 
assumed that the main error of the physical channel is 
the collective dephasing error as defined by eq.(l), all 
the 2-qubit codes will be sent robustly over the physi- 
cal channel, since the collective dephasing error will now 
only offer a trivial overall phase factor e lA . After Bob 
receives the 2-qubit codes, he decodes them in step 4. 
One may check it easily that after decoding, the original 
BB84 states are recovered provided that Bob's measure- 
ment basis to qubit 2 is same with Alice's "preparation 
basis" . 

We now give a very simple security proof for the above 
protocol in the way that if the protocol above is insecure, 
then the known BB84 protocol with CSS code proposed 
by Shor and Preskill [6] is also insecure. We first com- 
pare our protocol here with Shor-Preskill protocol [6]. 
The only difference between them is the encoding and 
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decoding in our protocol. Without these encoding and 
decoding, our protocol is exactly just Shor-Preskill proto- 
col. Suppose our protocol is insecure then eavesdropper, 
Eve must have a certain intercept-and-resend scheme S 
to obtain significant information to the final key in our 
protocol. Most generally, S may contain the intercept- 
ing the qubits from Alice, operation A to all qubits and 
ancilla, resending the qubits to Bob and finally a certain 
operation O to the rest qubits with Eve. Operation O 
can include certain type of measurement which optimizes 
Eve's information to the final key. We now show that if 
scheme S can help Eve to obtain significant information 
to the final key of our protocol, then we can always con- 
struct a scheme S' for Eve to obtain the same amount of 
information to the final key of Shor-Preskill protocol. 

Since the encoding procedure in our protocol requires 
no information to the original single qubit state and the 
decoding procedure requires no information to the 2- 
qubit code state, the encoding and decoding can actually 
be done by anybody. Lets consider the Shor-Preskill pro- 
tocol. Eve now uses attack S'. In scheme S', Eve replaces 
operation A by 

Encoding — ► A — ► Decoding 

and everything else identical to that in scheme S. Note 
that in scheme S', Eve resends the decoded single qubits 
to Bob and discards all "qubit 1" in each code after de- 
coding. If Eve uses this S' to Shor-Preskill's protocol, ev- 
erything will be identical with that in our protocol with 
Eve's attack S. In other words, to Eve, the game of at- 
tacking Shor-Preskill protocol with scheme S' is exactly 
identical to the game of attacking our protocol with S 
since she may just regard her encoding and decoding as 
operations done by someone else. More specifically, given 
Shor-Preskill protocol with Eve's attack S' and our pro- 
tocol with Eve's attack S, everything of the two protocols 
are identical therefore Eve's information to the final key 
of the two protocols must be exactly the same. This is 
to say, if our protocol is insecure, Shor-Preskill protocol 
must be also insecure. However, the security of Shor- 
Preskill protocol has been proven [6] already, therefore 
our protocol must be secure. 

Actually, we can give a more general theorem about the 
security of any protocol with quantum code. Consider 
two protocols, protocol PO and protocol P. In protocol 
PO, Alice directly sends Bob each individual qubits. In 
protocol P, Alice first encodes each individual qubits by 
a certain quantum code and then sends each quantum 
codes to Bob. Bob will decode the transmitted codes. 
After decoding, Bob obtains one single qubit state from 
each code and discarded all other qubits in the same code. 
Alice and Bob continue the protocol. Suppose except 
for the extra steps of encoding and decoding, everything 
else in protocol PO and protocol P are identical and the 
encoding and decoding do not require any information 
of the quantum state of the original qubit or the codes, 
then we have the following theorem: If protocol PO 



is secure then protocol P is also secure. The proof 
can obviously be done by the similar argucment: Eve can 
also do the encoding and decoding, if P is insecure under 
attacking scheme S, we can always construct an attack 
S' for Eve to attack PO effectively. 

Note that there are two important points here. First, 
the encoding must be independent of the original quan- 
tum state itself therefore Eve can also do so. Also this 
shows that the encoding does not offer extra informa- 
tion to the qubit state. The simple repetition code does 
not work because the encoding needs the information to 
the original quantum state and Eve is not able to do so. 
Also the repetition code will offer more information to 
the bit value. Secondly, Alice and Bob test the error rate 
after the decoding, that is to say, they directly test the 
error rate to the decoded qubits instead of testing the 
error rate of each qubits before decoding and then math- 
ematically deduce the error rate after decoding by using 
the collective dephasing property of the physical channel. 
Note that Eve may change all properties of the physical 
channel when the QKD task is being done. But in our 
protocol the error test is done after the decoding, this will 
defeat any type of Eve's attack. Since Eve does not want 
to be detected, she has to consider the error test done by 
Alice and Bob latter on. Therefore she must limit herself 
to those types of attack which will not affect the result of 
error test to be done by Alice and Bob. (Here Eve does 
not have to respect the error rate of the physical channel 
since that rate will not be tested in the protocol, but Eve 
has to respect the error rate after decoding since this is 
the issue that will be tested.) That is to say, if Eve is 
not detected by the error test, the protocol will work as 
effectively as the case that there is no Eve, since the key 
rate of the final key is uniquely determined by the error 
rate in test. 

After the above security proof, we can now further sim- 
plify our protocol. The encoding procedure in step I is 
just the local operation by Alice. She does not have to re- 
ally first prepare the single qubit state and then encodes 
it by controllcd-not (CNOT) operation. Instead, she may 
directly prepare the 2-qubit codes with each of them ran- 
domly chosen from {|01>, |10), ^(|01) + |10», ^(|01) - 

|10))} . These random codes can be produced with type 
II spontaneous parametric down conversion (SPDC) [8] 
with a certain filter [4] . In step 4 of our protocol, Bob 
measures qubit 2 in cither X basis or Z basis. This re- 
quires Bob to change measurement basis rapidly. How- 
ever, this task can be done by passive detection with a 
50:50 beam splitter, see figure I. In step 4, Bob takes 
unitary transformation U to qubit 2 according to the 
measurement result of qubit I. However, since we have 
already limitted ourselves to the 4 BB84 states, instead 
of taking U before the measurement to qubit 2, he may 
directly measure qubit 2 and then determine the corre- 
sponding bit value b according to the measurement result 
of both qubit 1 and qubit 2 through the following rule: 

{|+)|0),|-)|0),|+)|+),|-)|-)}^6 = 0; 
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Note that the state preparation and the bit value detec- 
tion are all local operations, nobody outside is able to 
know how they have actually completed the tasks. 
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FIG. 1. The source of two photons in the same line. BS: 
beam splitter, M: mirror, NC: nonlinear crystals used in 
SPDC process, p: pump light in horizontal polarization, ul: 
unitary rotator, u2: phase shifter, ul takes the value of 0, 7r/2, 
7r/4 to produce emission state |11), 1 00) , \4> + ), respectively. u2 
can be either I or <j z . F interchanges between states |0) and 
|1) (i.e., flip between horizontal and vertical polarizations). 

Intutively, the collective errors could happen more of- 
ten to qubits transmitted in the same line. This type of 
source can be produced by hgure 1. Note that the nonlin- 
ear crystal there can emmit either fully entangled state 
or product state, dependent on the polarization of pump 
beam [7]. We can use the following figure to realize the 
QKD protocol in decohercncc free subspace: 
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FIG. 2. Quantum key distribution in decoherence-free sub- 
space. The two qubits are now transmitted in the same line. 
Bob will use the results of events of simtaneous clicking of de- 
tectors (D1,D2) or detectors (D1,D3). He discrads all events 
of cliskings at different time or single clicking. 

The security is obvious if we regard the operation by 
the dashed rectangular as part of the decoding. This 
is now a probabilistic decoding with a rate 75% to dis- 
card the code. Consider the case of Shor-Preskill protocol 
where Eve use scheme S' for attacking. Eve detects the 
right vertical beam in |±) basis and also observes the 
photon number of left vertical beam in the same time. 
If there is no photon, he blocks the beam and sends Bob 
nothing. (Even though there is no photon at that time 
point, there could be a delayed photon in the same beam. 
Bob blocks the possible delayed photon.) If there is one 
photon, he takes unitary transformation U to that pho- 
ton and sends it to Bob. U is defined in step 4 of our 
protocol. Here Eve has used a very sophisticated photon 



detector to detect the photon number but not disturb the 
polarization on the left vertical beam. If Eves takes such 
operation, to Alice and Bob, they are carrying out Shor- 
Preskill protocol with a lossy channel with the lossy rate 
of 75%. However, we know that Shor-Preskill protocol is 
secure even the channel is lossy, since the corresponding 
entanglement purification also works with lossy channel. 
Therefore the protocol in fig. 2 must be secure since other- 
wise Shor-Preskill protocol would be insecure with lossy 
channel. 

Having considered the QKD protocol with the collec- 
tive dephasing channel, we now consider the case with 
collective equatorial rotating channel. Such a channel 

adds collective rotation ( C0S ^„ snl ^| ] to each indi- 

V — sin cos J 

vidual qubits with 9 value being random but same to all 
qubits simultaneously transmitted. A B92-like protocol 
was proposed recently [5] , the protocol tolerates the col- 
lective rotation error [5]. However the security for that 
protocol is not proven [5] . Also in that protocol, they use 
4 qubits to encode one bit, this will be technically very 
difficult and greatly decrease the efficiency because of 
the small emission probability of SPDC process. (Even 
though the probability can be improved in the future, 
one still cannot arbitrarily use large emission probabil- 
ity because this will cause the un-wanted higher order 
states.) To overcome these drawbacks, we propose a new 
protocol here. Our new protocol has the following advan- 
tages: 1) the security proof is given; 2)we use a 2-qubit 
state to encode one bit 3) the protocol is BB84-like and 
the efficiency is further improved compared with the one 
given in ref . [5] . Consider the fact that both 2-qubit state 
\4> + ) and state = "^(|01) — 1 10) ) are unchanged af- 
ter any collective equatorial rotation to both qubits. We 
can use these two states and their 2 linear superposi- 
tions to replace the BB84 state in QKD. Specificaly, the 
states transmitted from Alice to Bob are randomly cho- 
sen from {]</>+), |^), ^(|^+ + |^)), -^(\<P + ~ IVO)}- 
Note that -±(\cf>+ ± |^-» = ^(|0)|±) + |1>|=F>). There- 
fore this type of source can be easily made through com- 
bining the type II SPDC emission [8] and an electrically 
driven unitary crystal to make random unitary transfor- 
mations to one of the two emitted photons. The state 
from type II SPDC emission is \4> + ) ■ The random unitary 
transformations produced by the unitary crystal include 
unity, joint phase-flip and bit-flip, Hadamard transform 
and Hadamard transform with a flipping in {|±)} basis. 
Therefore the required 4 2-bit states will be produced 
randomly with equal distribution. Unlike protocol in the 
case of dephasing channel [4] , here we don't have to use 
a disentangler to generate the source. 

According to our theorem, to show the security of this 
protocol, we need only to show that these 4 2-bit states 
can be in principle generated from BB84 states without 
any information of the BB84 state and Bob can recover 
the original BB84 state on a single qubit by decoding 
the 2-bit code. If we can construct the encoding and 
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decoding, the security of the protocol is equivalent to 
that of Bb84 protocol. The encoding indeed exists. To 
encode, Alice makes the following unitary transformation 
on the BB84 qubit (the first qubit) and the ancilla (the 
second qubit) which is in state |0): 



|00) 



f 



v/2 



(|00) + |11));|1Q) 



1 

71 



(|01>-|1Q». (3) 



In such a way, BB84 state |±) with ancilla |0) will be- 
come ^7|(l ( / )+ ) i ))■ So in principle, there is indeed an 
encoding scheme to produce the requested 4 2-bit states 
from BB84 states. Now we show Bob can recover the 
original single qubit state. To do so Bob measuress the 
first qubit in Z basis, if he obtains |0), the original state 
has recovered on the second qubit, if he obtains |1), he 

takes unitary transformation S = ( ^ J ^ to the sec- 
ond qubit and the original state is also recovered up to an 
overall phase factor on the second qubit. However, such 
a unitary transformation according to the measurement 
outcome of the first qubit requires active operations. We 
can simplify it to the equivalent passive operation with 
post-selection. Without any loss of generality, a mea- 
surement to state E|x) in basis is equivalent to 
a measurement to \x) in basis {S^|g)(g|S} followed by a 
unitary transformation E. This is to say, Bob takes the 
individual measurement to the first qubit in Z basis and 
the second qubit in either X basis or Z basis and deter- 
mine the bit value b according to the joint measurement 
outcome on both qubits: 



{|0)|0),|1)|1),|0)|+),|1)|-)}— .6 = 0; 
{|0)|1),|1)|0),|0)|-),|1)|+)}— .6 = 1. 



(4) 



Note that Bob's record on "measurement basis" to each 
encoded bit is same as his measurement basis to the sec- 
ond qubit. He will discard those results obtained from a 
wrong measurement basis through classical communica- 
tion with Alice. 

Moreover, if we exchange the two qubits before any 
measurement done by Bob, all results of the protocol is 
unchanged. That is to say, here Bob can chose any qubit 
as "qubit 1". Thus in the application Bob just make 
sure the measurement basis to one qubit is Z, while the 
measurement to the other qubit can be either X or Z and 
then use the rule of eq.(4) to determine the bit value. 
The expcrimantal scheme is given by the following figure 
3. Bob will use the results of any 2-fold clicking events 
in {(Dl, Di), (D3,Di);i = 1,2,3,4}. He determines the 
bit value according to eq.(4). Note that the 2-fold event 
(D1,D1) or (D3,D3) means that detector Dl or D3 clicks 
2 times at different time. Those events of 2-fold clicking 
which contain neither Dl nor D3 will be discarded. 
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FIG. 3. Robust quantum key distribution with collective 
equatorial rotating channel. U is a crystal driven electri- 
cally to produce random unitary transformation selected from 
{/, E, H, a z H}. H is a Hadamard transform which inter- 
changes {|0),|1)} and {|+), |— )}, respectively. The devices 
inside the dashed rectangular are denoted by C. 

Foe completness, we give the following protocol with 
collective rotating channel: 

Protocol 2. 1: Alice creates (4 + 5)n 2-qubit quantum 
codes with each of them randomly chosen from the set 
{|0+>,|^),^(|0+) + |^-)),^(|0 + >-|V^»}. 2: For 
each 2-bit code, if it is in state \4> + ) or \ip~) she puts down 
the "preparation basis" as "Z basis" otherwise she puts 
down the "preparation basis" as "X basis". For those 
code states of \<fr + ) or |-1=(|0+) + \ip~)), she denotes a bit 

value ; for those code states of or |-1=(|0+) — \ip~)), 
she denotes a bit value 1. 3: Alice sends the 2-qubit codes 
to Bob. 4: Bob receives the (4 + 8)n 2-qubit codes. To 
each code, He measures one qubit (say, qubit 1) in Z basis 
and measures the other qubit (say, qubit 2) in either X 
basis or Z basis. Bob denotes his "measurement basis" 
just the same of his measurement basis to qubit 2. And 
he determines the bit value correspondoing to each code 
by eq.(4). 5: Alice announces her "preparation basis" 
for each codes. 6: Alice and Bob discards those bits on 
which Bob has measured in a basis diffrent from Alice's 
preparation basis. With high probability, there are at 
least 2n bits left (if not, abort the protocol). Alice decides 
randomly on a set of n bits to use for the protocol, and 
the rest to be check bits. 7: Alice and Bob announce 
the values of their check bits. If too few of these values 
agree, they abort the protocol. 8: Alice and Bob distill 
the final key by using the classical CSS code [6]. 
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